6 ms·

I shares worries I've seen expressed elsewhere that this opens up a social engineering attack vector where an imposter gets through to phone support and says "o

I shares worries I've seen expressed elsewhere that this opens up a social engineering attack vector where an imposter gets through to phone support and says "oh I just typed a bunch of gibberish for the answer and can't remember it." Wouldn't a false, long, maybe hyphenated, but plausible surname be better for this reason?

city41 9y ago
I also generate them with a password manager. FWIW, I always start with “it’s a long gibberish string” and no one has ever been satisfied with that. I’ve always had to recite it. Anecdotal I know.
- iak8god 9y ago
  Sure, but you're not spending all day running customer service "DoS attacks" against people's bank accounts. Even if "it's gibberish, and I forgot it, can't you please help me out" only works one time out of a thousand, do you really want to bet your bank balance on a weak link customer service rep who's just a tad too eager to help?
  - city41 9y ago
    I think it’s all debatable. That human will always be a weak link. It just takes one representative to forget to ask or get convinced with “oh it’s my wife’s mother’s maiden name and my wife isn’t here and I’m in a real bind”. But in exchange, my security answers are no longer compromisable online. I think overall it’s a positive trade off, but that’s just my hunch.
    - iak8god 9y ago
      Well, for sure it's better than using your mother's actual maiden name. But I'd rather see security questions done away with altogether.
      - city41 9y ago
        I agree, I think they’re a real problem. I think it’s possible to eliminate human error over the phone too. Perhaps design a system that doesn’t let the representative into your account until they type in the 2FA token your phone provides or something (I don’t really know, I’m far from a security expert)
- rat87 9y ago
  I just wrote a mini rust script (https://github.com/rtaycher/make_password https://github.com/rtaycher/make_password) to spit out 5 random dictionary words for secure passwords I need to share. Everything else gets auto generated by keepass, i should probably just figure out how to write a keepass plugin
  - dimensi0nal 9y ago
    Have you considered using the EFF's diceware wordlist? It's designed for this. https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt
  - jtmarmon 9y ago
    1Password allows you to generate word based passswords instead of random strings. I do this because it’s much easier to type manually if I’m logging into a system where I can’t copy paste from 1P
  - arthurfm 9y ago
    > I should probably just figure out how to write a keepass plugin KeepassXC already has this feature [1][2]. It can also store and generate OTP codes and works with YubiKeys (similar to Bitwarden Premium). There's also a popular Python script called xkcdpass [3] which does the same from the command-line. [1] https://keepassxc.org/images/screenshots/windows/screen_006.png https://keepassxc.org/images/screenshots/windows/screen_006.... [2] https://keepassxc.org/ https://keepassxc.org/ [3] https://github.com/redacted/XKCD-password-generator https://github.com/redacted/XKCD-password-generator
chrismorgan 9y ago
To protect against such attacks, I write some normal English before getting to the randomness, something along the lines of “This MUST be quoted exactly or it is wrong”. That’s ~40 characters “wasted” (they’ll normally have distressingly low character limits, but I find them to normally be at least 50 characters), but I’m optimistic about it offering reasonable protection against such an attack. In practice, I’ve never actually had to quote such a string to anything but a machine, so it is mere optimism on my part.

city41 9y ago

I also generate them with a password manager. FWIW, I always start with “it’s a long gibberish string” and no one has ever been satisfied with that. I’ve always had to recite it. Anecdotal I know.

iak8god 9y ago
Sure, but you're not spending all day running customer service "DoS attacks" against people's bank accounts. Even if "it's gibberish, and I forgot it, can't you please help me out" only works one time out of a thousand, do you really want to bet your bank balance on a weak link customer service rep who's just a tad too eager to help?
- city41 9y ago
  I think it’s all debatable. That human will always be a weak link. It just takes one representative to forget to ask or get convinced with “oh it’s my wife’s mother’s maiden name and my wife isn’t here and I’m in a real bind”. But in exchange, my security answers are no longer compromisable online. I think overall it’s a positive trade off, but that’s just my hunch.
  - iak8god 9y ago
    Well, for sure it's better than using your mother's actual maiden name. But I'd rather see security questions done away with altogether.
    - city41 9y ago
      I agree, I think they’re a real problem. I think it’s possible to eliminate human error over the phone too. Perhaps design a system that doesn’t let the representative into your account until they type in the 2FA token your phone provides or something (I don’t really know, I’m far from a security expert)
rat87 9y ago
I just wrote a mini rust script (https://github.com/rtaycher/make_password https://github.com/rtaycher/make_password) to spit out 5 random dictionary words for secure passwords I need to share. Everything else gets auto generated by keepass, i should probably just figure out how to write a keepass plugin
- dimensi0nal 9y ago
  Have you considered using the EFF's diceware wordlist? It's designed for this. https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt
- jtmarmon 9y ago
  1Password allows you to generate word based passswords instead of random strings. I do this because it’s much easier to type manually if I’m logging into a system where I can’t copy paste from 1P
- arthurfm 9y ago
  > I should probably just figure out how to write a keepass plugin KeepassXC already has this feature [1][2]. It can also store and generate OTP codes and works with YubiKeys (similar to Bitwarden Premium). There's also a popular Python script called xkcdpass [3] which does the same from the command-line. [1] https://keepassxc.org/images/screenshots/windows/screen_006.png https://keepassxc.org/images/screenshots/windows/screen_006.... [2] https://keepassxc.org/ https://keepassxc.org/ [3] https://github.com/redacted/XKCD-password-generator https://github.com/redacted/XKCD-password-generator

chrismorgan 9y ago

To protect against such attacks, I write some normal English before getting to the randomness, something along the lines of “This MUST be quoted exactly or it is wrong”. That’s ~40 characters “wasted” (they’ll normally have distressingly low character limits, but I find them to normally be at least 50 characters), but I’m optimistic about it offering reasonable protection against such an attack. In practice, I’ve never actually had to quote such a string to anything but a machine, so it is mere optimism on my part.